The paper isn't really about attacking GPS infrastructure. It's about attacking GPS receivers. Some of these receivers may be part of other sorts of infrastructure. I was at CCS when the paper was presented. It's all about sending fake GPS satellite signals to receivers to exploit bugs in the software in the receivers. The work is interesting and includes attacks which can desynchronize the clocks on some devices and there was one device you could essentially brick by telling it at the satellite was at radius 0 (center of the earth) resulting in a divide by 0 overflow. I liked the paper and thought it was neat, and it could do serious damage to particular systems which rely on GPS if they have the right type of flaws in their software to be exploited by this attack, but it was not an attack against the GPS satellites or anything like that.

Err, I just meant divide by 0 error, not overflow. The fun bit of that attack is that the reason it effectively bricks it is that the divide by zero error crashes it and it reboots, but it logs its data into flash, so as soon as it finishes rebooting, it starts reprocessing the stored data, thus it reads the 0 again and crashes and it just gets stuck in a loop like that forever. It's a fairly fun and clever paper.

I'm pretty certain that this is how Ian has intercepted and captured at least two US drones

Who is this drone-intercepting and capturing Ian ?

Well, as you likely know, most bagpipes have two or three drones, and Ian is a common Scottish name, so I'm pretty sure he's a Scotsman who managed to hijack some American bagpipes in transit. Clearly, the US needs to protect them better when they're transiting through the UK.

Researchers have developed attacks capable of crippling Global Positioning System infrastructure critical to the navigation of a host of military and civilian technologies including planes, ships and unamed drones.

What happens if they run "uname -a" then?

Seriously, you had to go that far, when they had "Global GPS" (yep, Global Global Positioning System) right in the headline?

Seriously though Slashdot management must have zero concern about low quality, sloppy, careless editing. I would fire in a heartbeat any so-called "editor" who can't even bother to run a spell-checker at least once in a while.

Yeah? YMBNH...

What an insult to everyone else who is expected to actually perform and do a good job to earn their paycheck. In this economy there are PLENTY of people who would do a better job and possibly for less money than what Slashdot staff are currently making. Perhaps they should start contacting Slashdot management and making offers? The current crop of "editors" would be no competition at all.

It is widely suspected that the current crew of/. do not receive a "paycheck" at all, but are paid in bananas, peanuts, or some such simian treat. But if you want them put away, feel free to contact the local zoo with a tip about their missing baboons....

So that is interesting. Some GPS receivers have software errors that all bad input to brick them. It is no surprising because on thing that too many automated systems do not protect against is malicious input. This is, however, the sort of thing that be handled by a software update, if a GPS is capable of such a thing.

Modern consumer-type GPS receivers are all updateable, but not all will receive updates of course. Old school units might actually use windowless EPROMs (for cost-saving) and might not be upgradable by any reasonable means (short of desoldering...)

If it was news you'd see it on Carver Media first. We saw this attack used in 1997 to start open hostilities between China and Britain. Luckily we had a man in the area and he managed to stop it before anybody went nuclear.

How much do you know about the workings of GPS? I ask because I wonder if there is anything in the current implementation that would prevent adding a digital signature to the tracking signals without breaking compatibility with existing devices?

Basically if the packet isn't signed, we just ignore it. I imagine for mission critical devices (e.g. commercial aircraft relying on IFR) they could upgrade the devices rather quickly. Consumer devices would of course be screwed in the current generation, but I don't

They've always been phasing in new birds to replace older ones, each with a new set of features, pretty much non-stop since they started, using the old ones as spares until they were retired. I believe the phase 2 birds rolling out before the phase 1 deployment even had the full intended coverage. Most civilian implementations probably have a limited feature set (all we really need is mapping) but I don't know if there is any kind of packet signing.

All consumer GPS can do is get the date, and current position. They use other sensors and/or multiple readings to get your heading and speed. This information is then fed into mapping software that is already on the device that may or may not rely on more data off the internet. I'm unsure of what military features they may have aside from getting better fixes on your location, but clinton removed some/all consumer restrictions on fix resolution in the 1990s.

I can still receive a legit signal, delay it and broadcast the delayed signal to the victim. And no, it is not easily to detect this "discontinuity" as loss of signal is rather common. Just drive through NY or a very mountainous area and you will find out why.

Yes, that is a man in the middle attack, which is an understood problem, and one of the ways to counter that is authentication which uses a timestamp. Given that GPS is entirely based around having extreme precision timestamps, it's probably not going to be very difficult discard 'delayed' messages.

Running an internal clock with precision (within seconds per year) is trivial. At best you could only delay messages a second or two before the receiver decided something was fishy. And that assumes a very sim

"Researchers Find Crippling Flaws In Global GPS" is misleading ?
Oh I see the flaw is not really in the global GPS system, thanks a lot for your post, I don't even have to read the fucking TFA thanks to you
(I had mod points for you but you are already at +5 (twice) so...)

Well, thanks for the kind words anyway. Honestly, I thought that modding up my second comment (which was mostly just meant as an error correction) was excessive. If I'd known it would've been modded up, I might've not made it as I don't want to be a karma whore. But, oh well, I guess I shouldn't look a gift horse in the mouth.

This isn't news. The GPS signal is very, very weak. It's actually right at the noise floor and using some rather ingenious encoding to resolve the signal. The signal itself is fully-documented for consumer equipment. Given the weak signal strength and the protocol having no encryption or validation to speak of, of course jamming is possible; Receiver selectivity dictates it'll lock on to the strongest signal, the root square law dictates that just about any terrestrial source with line of sight will be stronger than the one in space. The only problem to work out then is processing; You have to figure out where the receiver is now, and then figure out where you want it to be, and adjust all the signals it could receive from the GPS satellites simultaniously to cause it to (falsely) lock on to the new position. And considering that the timing needs to be in fractions of a millisecond to have any value at all, you need to be very exact.

Most of the equipment is dedicated to computing what the signal needs to be.... the actual transmitter is dirt cheap.

Or maybe they did, you know, actual research for their solutions, and rather than being selfish cunts about it, decided to actually publish their results and contributing to the research community instead of hiding everything and smashing everything that competes with it down by using vaguely written patent applications? As hard as it may be for slashdot to believe, governments and corporations can occasionally do something right.

I don't think you looked at the paper really. GPS spoofing and jamming are nothing new (as is mentioned in the paper). The new aspect is that there are software attacks that can be done on the receivers.
For example, one of the divide by zero errors will cause a denial of service attack on some receivers. This is vastly different from jamming, because the DoS continues even after the transmitter is shut off. Jamming would obviously stop as soon as the transmitter is turned off. That is the new, exciting, and dangerous part of all this.

Thank you for your sarcastic comment on behalf of everyone else. We're all such complete cocks that we get offended when someone explains something we're proud of working out for ourselves, because it takes away one of the few tiny achievements we will manage in our sad pathetic lives.

(That above paragraph was sarcastic... the following paragraph is not.)

You're a dickhead AC. (That's a person who behaves in a selfishly annoying way for his own pleasure, not actually someone with a penis for a head. And I wa

"(That above paragraph was sarcastic... the following paragraph is not.)"

I'm glad you included the parenthetical phrase... oh, never mind.;)

Don't let the 13 year olds get to you. And by "13 year old" I don't mean the AC is actually 13, although he might be. He might also be a 35 year old who still lives in his mother's basement but acts like a 13 year old.

Up until about 3 years ago we in North America had another electronic navigation system in-place and operational: LORAN C.

The loran system -though not as precise as GPS- was in many respects much more difficult to jam. Upgrades were planned that would have improved the loran system; instead, in a spectacular case of "penny wise-pound foolish" the sysetm was turned off, and its infrastructure (think 'some of the tallest antenna masts ever built' ) quickly dismantled/destroyed.

http://en.wikipedia.org/wiki/LORAN [wikipedia.org]From Wikipedia:"In November 2009, the U.S. Coast Guard announced that the LORAN-C stations under its control would be closed down for budgetary reasons after January 4, 2010 provided the Secretary of the Department of Homeland Security certified that LORAN is not needed as a backup for GPS.[19]

On 7 January 2010, Homeland Security published a notice of the permanent discontinuation of LORAN-C operation. Effective 2000 UTC 8 February 2010, the United States Coast Guard terminated all operation and broadcast of LORAN-C signals in the USA...

[In the quoted Wikipedia article, the following paragraph was placed BEFORE the above]
Originally completed 20 March 2007 and presented to the co-sponsoring Department of Transportation and Department of Homeland Security (DHS) Executive Committees, the report carefully considered existing navigation systems, including GPS. The unanimous recommendation for keeping the LORAN system and upgrading to eLORAN was based on the team's conclusion that LORAN is operational, deployed and sufficiently accurate to supplement GPS. The team also concluded that the cost to decommission the LORAN system would exceed the cost of deploying eLORAN, thus negating any stated savings as offered by the Obama administration and revealing the vulnerability of the U.S. to GPS disruption.[18]"

end of quoted Wikipedia material

Loran and its technological successor E-loran are still available in some more enlightened parts of the world (see linked article)

Note that I am a USian. The above is NOT one of my country'smore shining (dare I say 'brighter') decisions.

Yup, rather dumb move, saving peanuts compared to most budgets, but the US Coastguard ran it, and they're really strapped for cash.

Shame, since as well as the benefits you note, the infrastructure was successfully used to broadcast data to augment GPS accuracy. This would perhaps been a more convincing arguement for keeping it in place, since it's true that in recent years usage was reported to have dropped considerably.

The loran system -though not as precise as GPS- was in many respects much more difficult to jam.

If you'd read the article, you'd have realized that it wasn't about jamming the GPS signal. It's about sending false data to GPS units in order to attack them directly and cause crashes, brick the receivers, etc. Loran being more difficult to jam does not mean that Loran systems would be any less vulnerable to the types of attacks discussed in the article.

LORAN was a great system, but I'm not sure the decision to shut it down is as shortsighted as you imply. LORAN wouldn't be used much now that GPS receivers are so widespread and cheap. It would still be useful as a backup on ships but if someone wanted to run a ship aground using GPS jamming they could also jam LORAN. There's no reason to think LORAN receivers wouldn't have similar software bugs as GPS receivers. Either way, the appropriate backup for GPS, LORAN or both is a navigator who knows what he'

True, but it's a daily problem for ATC in some parts of the world. North Korea jams GPS around ICN on a regular basis. Even EWR had a GPS issue for some time. They figured a trucker was using a GPS jammer to block the logger on the truck. Every time the truck would drive near the airport it would create a hassle.

Pretty much here in Australia. I have taken to hanging out beside runway 16/34 at Tullamarine in Melbourne, recording MODE-S data. Anything medium or heavy with a normal turbine engine has ADS-B. Many turboprops do and some rotorcraft. But I also found out that tulla is a great place to pick up garbage data, probably from the maintenance facilities. I got one track with lat=0.0,lon=0.0

Planes especially very much rely on GPS, it's at the heart of all navigation systems in airliners. Even most private GA pilots use handheld ones if it's not part of the panel, unless they are intentionally flying by railroad tracks and highways. I believe LORAN was shut down a few years ago. The US Navy considers sextant use so useless that it was dropped from required study at the Academy some years ago, although it may still be taught as an elective.

You are a really misinformed troll.The missinformed troll is you.I did not debate the usefulness of GPS or its wide adoption. I debated the word rely. If I rely on something it implies I'm helpless without it. Which is not the case.If you only know about sextants (and that they are no longer used - which I doubt) then you don't know much about navigation, especially on ships.

GPS is also at the heart of many military precision guided missiles and shells. Every one knows that, so you can safely assume I know

Airliners don't rely on GPS. They use it, because it's convenient, but they don't rely on it. If GPS fails airline pilots are quite capable of using land based radio navigation aids (yes, they still exist, no they are not LORAN), inertial navigation or dead reckoning. I believe general aviation pilots qualified for visual flight rule must still be able to navigate without instruments (thus visual flight rule) and instrument flight rule pilots must first be VFR qualified. The US navy might have eliminate

Right.. Not like the FAA is trying to move to a new way of tracking planes using GPS or anything.. (http://www.faa.gov/nextgen/implementation/programs/adsb/) Or that Alaska Air already uses it on all its planes..

However they can. That was my point, so the TFA is either wrong or the summary is wrong.

E.g. my body functions rely on a working pancreas for insuline (or on insulin injections). I can not live without insulin. Hence I rely on it.

Just because people are trained to do without GPS in case of problems doesn't mean they don't rely on it in actual daily practice.As a navigator on a ship you are required to crosscheck your positions with non GPS means.That is either si

Having gone to a maritime school, a lot of my friends are on the bridge of large ships. A lot.

They can go without it, but GPS is so easy, convenient, and reliable that they basically rely on it. Shooting the stars with a sextant is relegated to trainees and practicing for the various exams which are required to be promoted to second mate, first mate, and finally master.

So they don't use landmarks, no signals like lighthouses no depthsfinders etc?

How exactly should it work to drive by GPS?

You don't plot your course on a map? Or if you do and your GPS tells you you are left, you steer more right?

That means you don't use a compass to define your heading? You don't know what the "missdirection" of your compass is in your sailing area? You don't know the influence of your ship/boat on your compass?

Sorry, to pilot a boat with GPS only is simply retarded. Regardless how convenie

Commercial airliners are still equipped with other navigation systems, but most of them are beacon systems that are only useful when you're close to an airport. These systems are still used for landing. For long distance navigation, the non-GPS systems are almost all a distant memory. It's *possible* to navigate a plane with a compass and a clock, and if you're flying low enough (and in an area with enough airports) it's possible to navigate by switching beacons, but I wouldn't want to hazard that in a plane the size of most commercial airliners. It's the kind of thing you do (and are trained to do, or at least were when I was taking lessons) in a Cessna, not a 767.

The real concern is that the occupants of the plane have no way of knowing that their GPS information is bad in the first place. You can have a thousand backups available to you, but if you don't know that your primary system is being fed bad information, are you going to check/trust the backup that's based on technology developed a century ago (seriously... clock/compass is how Amelia Earhart and Fred Noonan were navigating)? And assuming that the GPS actually *crashed* (in the DoS way described in TFA), you'd still have Air Traffic Control to tell you where you were... they don't use GPS, they use radar.

Large airliners also have inertial navigation (certainly if they are going trans-ocean). Works just fine with no GPS.

Also IFR-capable GPS receivers, whether they are in a small single engine plane or a state-of-the-art B787 have RAIM (receiver autonomous integrity monitoring). The pilots *will* know if the GPS is getting bad data, because the GPS will detect this condition.

Even over the continental US radar coverage is patchy, and it won't help you out at sea. The reason the US government gave up its ability to completely disable GPS is that the FAA wanted to use it instead of radar for some areas.

As far as I'm aware, large commercial airplanes all still have inertial guidance. "There's more than one way to do it" has been the rule in air navigation for a long time, and that won't change anytime soon.

Not all of them have GPS, either. AF 447 could have been saved if one of the pilots had bothered to bring a sub-$100 Garmin with them. Instead, it was "Derp, what's an ocean doing up here at 40,000 feet?"

You can still navigate an airliner cross country the way they did before GPS, using dead reckoning and inertial navigation between VOR and ADF stations. Airline pilots are still required to know how to do this.

Planes don't generally use GPS for altitude at all (which is the biggest concern for bad GPS data). If you're not an idiot you use all the navigation information available to you, including GPS, radar, other electronic navigation aids, gyro compass, magnetic compass and your two eyes looking out the

I actually found Bermuda that way. I ran a latitude line east until the radio beacon on the north end of the island bore due south. I have no idea how many of those old time radio beacons are left and it is a major PITA getting around that way compared to GPS.

Don't forget DSC - that will go tits-up too. Can you imagine AIS with a bunch of spoofed GPS positions? OMFG that would be bad in a crowded area:( Likewise spoofed ADS-B.
BTW - I heard a Mayday call go out because the *backlight* on a GPS died and the skipper could not find his way home after dark. It was a clear night and he was anchored NEXT TO A LIGHTHOUSE and he was LOST ANYWAY!

What the fuck is with the science press in Britain / Australia about the word "boffins"? Why does every single science article, without fail, have to have some supposedly clever pun or alliteration around the word? (Extra points for using the word astro-boffins [theregister.co.uk].)

I've gotten to the point that if I see the word "boffins" in a science article, I immediately click away. Please make it stop!

Why is that any different to researcher or expert or scientist? They are just as useless or even less useful terms

It is an Australian article using "Australian English" or "British English"... the term is well understood to define an academic/researcher with a very strong but narrow focus in a typical theoretical area.

It is no more problematic than terms like futurist (who has a broader focus) or your typical engineer/scientist labels (for those who are more problem solving focused).

The TEDxAustin talk you mentioned is focused on GPS spoofing to make a receiver think that it is somewhere else. Spoofing in that sense has been around for a long time, and while it is very cool and everything, it isn't what is novel about this paper/attack.
This paper goes from just making a GPS receiver think it is located somewhere else to actually exploiting software vulnerabilities in GPS receivers to cause them to crash and things like that. The attacks are related, but the position based spoofing i

Isn't this exactly why the P-Code is encrypted in the military signal? Spoofing the C/A data has been a known vulnerability in the system since day 1. The rest of the problems are simply bad programmers. That's not a limitation or vulnerability in the GPS system - it's a problem with the receiver manufacturers and the BS test & validation done by the civilian side of the government when they put those receivers in the CORS stations. I saw the code in some of the old reference receivers (in the 90s) - it

Okay, there's two things going on here. You're assuming confidentiality only when encryption is perfectly capable of providing both confidentiality and integrity. Basically with encryption (if you do it right) you can assure both that the enemy cannot use your signal *and* that the signal you got as legitimately sent from your outer space transmitter.

Of course you could potentially jam the military signal, though Frequency-Hopping Spread Spectrum [wikipedia.org] tends to make this...challenging. So you have an encrypte

is what the Navy and the rest of the Military/Covert Ops use they are sorely misled. In fact, general researchers would be required to have top secret classified clearance and most certainly would not be publishing their findings. NASA has several levels of GPS solutions. We lowly consumers use very old tech for GPS/GIS.

Are receivers for other global positioning systems like Galileo and GLONASS also vulnerable to these attacks? If so, is it too late (or even possible in theory) to fix the problem in those systems, given that they aren't fully online or in widespread use yet?

I can't fucking believe it. Do you mean to tell me that if you have a receiver tuned to a certain frequency, and you have a transmitter on that same frequency, then you can transmit information from the transmitter to the receiver?

Top it off though! If you have not one but two - TWO transmitters, and one is vastly more powerful than the other, then you can get the receiver to receive the stronger one over the weaker one?

Completely fucking amazing, if you ask me. I had no idea you could do something like tha

Bump keys [wikipedia.org] can be used to unlock just about any door, and yet crime statistics remain in line and have even been dropping in many parts of the world since the Internet has raised their profile in recent years.

This would be more interesting if someone were droning my neighborhood, but some of the hacks took days, not minutes to perform (and as others pointed out, affects individual receivers, not the entire system). Hardly a James Bond villain level of manipulation.

Proper summary should be, "In other news, shitty software is shitty." THAT aspect is interesting, largely because few people realize how shitty most of it is, nor where that shittiness is found, vs. where we expect that shittiness should not be. That you can brick a receiver with a divide by zero in a cached almanac... the genius pool at $GPSCO being of THAT quality may be news to most.

GPS was essential in 1989.Today, your average smartphone (without GPS) just using the camera, onboard sensors, and a few tens of gigs of stored imagery can get really accurate position tracking, at least in good weather. Less ideal in broken cloud.

First off. GPS guided bombs and missles make it so we attack a building with a single bomb, rather than our old method which was to carpet bomb the entire city and 20 miles around it with thousands of bombs.

Second off. The bomb will now hit some non-target rather than the target. Hope your kid doesn't happen to be in the school it just hit rather the command bunker it was supposed to hit.